In Section REF , we discussed what CTI is and highlighted that it can be categorised into four main types: (i) strategic, (ii) operational, (iii) tactical, and (iv) technical. Each of these types of intelligence convey a narrative about a threat, however do so in diverse range of ways, specific to their intended recipients. For example, Technical CTI is made up of data that describes the physical attributes of an observed attack (e.g., IP address, MAC address, Malware Hash, etc), intended to be consumed by technical resources [1]}.
